Spark RAT Campaign Hits Cambodia via Vulnerable OPSWAT Driver

An open-source RAT, a signed driver, and a blind spot

Attackers have been sending phishing lures themed around Cambodia to install Spark RAT, a remote access trojan that anyone can download from a public code repository. To get past defenders, they load a vulnerable kernel driver from OPSWAT's AppRemover product and use it to shut down endpoint security software. Acronis's Threat Research Unit documented the campaign. It reports finding malicious artifacts from late June through early August 2026 and says it cannot tell whether the operation is still running.1216

Each technique in the chain is familiar on its own. What stands out is the combination: a free, publicly maintained remote-control tool sits at the end of a delivery chain that abuses a trusted, signed component from a security vendor. This campaign shows how freely available offensive tooling and the Windows driver trust model together make an attacker's job easier, and attribution harder.

How the attack chain works

The outlets that covered the campaign agree on the mechanics, mostly because they all draw on the same Acronis analysis. Victims receive compressed archives holding an Inno Setup installer. The lures include Cambodian government notices, public health announcements, dental examination records, real estate paperwork and promotional offers.12 One archive name that analysts recovered posed as a government notice on COVID-19 prevention and used a double extension, ".docx.exe", to look like a document.18

Once run, the installer starts a DLL side-loading chain through a signed Tencent executable.12 The loader runs a timing check to spot sandboxes that speed up sleep calls, and exits if the elapsed time looks wrong. It also looks for Huorong Internet Security, a Chinese endpoint product, and tries to reduce its privileges.12 Later stages are encrypted shellcode hidden inside PNG files. A second stager checks whether it already has SYSTEM privileges. If it does, it injects straight into "vssvc.exe". If not, it first sets up a Windows service for persistence, unless it detects Qihoo 360 processes.1216

The next payload patches AMSI and Event Tracing for Windows, creates a scheduled task, and installs ardrv.sys.12 Acronis says the driver version it recovered is vulnerable to CVE-2026-36425. The flaw sits in a specific IOCTL handler that lets local users ask for processes to be terminated without proper privilege checks.16 With the driver loaded, the malware kills security processes at the kernel level, including Microsoft Defender, Huorong and Tencent PC Manager.12 One account adds 360 Total Security to that list. It also notes that the malware adds Defender exclusions for paths such as C:\Drivers and C:\Windows\System32, and runs a separate user-mode step that enables SeDebugPrivilege and calls TerminateProcess on any remaining tools.15 Finally, Spark RAT is injected into "ctfmon.exe" and connects to sx[.]nuihuw[.]com on port 443, with nuihuw[.]top as a backup.1216

The open-source angle: a RAT anyone can download

Spark RAT matters because it is not custom malware. Acronis describes it as an open-source, cross-platform remote access trojan written in Go by a developer known as XZB-1248 and released publicly in 2022.16 Cyber Florida's profile dates the first GitHub release to March 2022 and says the tool got little attention until early 2023. It also reports more than 500 forks of the repository and over 16,000 downloads of the latest release.1

The feature set covers what an operator needs once inside a machine. Earlier analyses list remote PowerShell and system commands, file upload, download and deletion, screenshots, system information collection, and forced shutdowns or restarts. Commands and data travel over WebSocket.8 PCrisk's write-up adds a process manager, a desktop monitor and a file editor, all run from a browser-based panel.9 SentinelOne's work on the DragonSpark cluster in early 2023 called it the first consistent malicious use of Spark RAT, and noted that the tool's frequent updates make it attractive to attackers.6 Since then it has appeared in operations linked to Winnti, in post-exploitation activity tied to the HelloKitty and TellYouThePass ransomware attacks, and in a trojanized Korean VPN installer.74

Public availability shapes defense in two ways. First, indicator lists lose value. Fortinet notes that because many different actors use Spark RAT, any given set of hashes or IPs covers only a tiny share of real activity.7 Cyber Florida makes a similar point: the large number of forks suggests the code is being adapted into custom variants, each with its own indicators.1 Older guidance said Spark agents listen on port 8000 by default.1 In the Cambodia campaign the operators used port 443, so the RAT's traffic looks like ordinary HTTPS.16

Second, open-source tooling blurs attribution. When a ready-made RAT is the payload, the payload says little about who deployed it. That is exactly the difficulty in this case.

Attribution: where the reporting diverges

The sources disagree most on who is behind the campaign. Acronis lists several overlaps with Silver Fox tradecraft: DLL side-loading through a signed application, multi-stage delivery, persistence through services and scheduled tasks, Defender exclusions, and a BYOVD routine that also references TrueSight and Zemana Anti-Malware SDK drivers that Silver Fox has used before.12 It also points out that targeting Huorong has repeatedly shown up in earlier Silver Fox activity.12

Even so, Acronis stops short of naming the group. It found no shared infrastructure, no unique campaign marker, no function-level code reuse and no matching certificates. It also notes that the final payload is Spark RAT rather than the ValleyRAT (Winos 4.0) usually seen in Silver Fox operations.16 The company calls the activity an unattributed cluster with low-confidence ties to the wider Silver Fox ecosystem.18 What it will say is that the Spark configuration contains a Chinese-language value and that the security products targeted are common in Chinese-speaking environments.12 The configuration it published includes a "note" field with the Chinese word for "default".16 That detail is weak evidence of anything, because it may simply be a setting left unchanged from the open-source tool.

SentinelOne's summary takes the same cautious line. It describes the tactics as closely resembling Silver Fox but keeps the cluster unattributed.20 Aviatrix's threat-research write-up goes further. It frames the campaign as part of a rise in "nation-state and advanced persistent threat" sophistication and says Cambodian government entities were specifically targeted.11 It also gives a CVSS score of 6.5 and estimates five days of downtime and $75,000 in losses.11 None of those figures appear in the original research. The primary reporting describes "individuals and organizations" as targets and a mix of lures that includes dental records and promotional offers, which does not point clearly to an espionage operation aimed at government.12

The Acronis reading is the better-supported one. The overlaps with Silver Fox are real, but they consist of shared techniques, not unique fingerprints. When the payload is a public RAT, borrowed techniques are about the only signal available. Calling this a state operation goes beyond what the evidence shows.

Why BYOVD keeps working

In the attack itself, the vulnerable driver is the most consequential element. Ankura's summary stresses that the driver lets attackers raise privileges and switch off Defender and other endpoint products before they set up persistence and inject code.17 Aviatrix, despite its framing, makes a fair point: abusing signed drivers takes advantage of the trust operating systems give to digitally signed components, which leaves a real blind spot for defenders.11

The irony is plain. The kernel code that disables security tools here was itself signed for a vendor product, and the RAT that follows is a public repository. Neither piece needs zero-day research or a large budget. A modest operator can link free and legitimately signed parts into an intrusion that silences defenses before the remote-access stage starts.

What defenders should take from it

The practical steps follow from the analysis. Block known-vulnerable drivers such as ardrv.sys at load time, because once the driver is running, the endpoint agent may already be shut down. Detection based on behavior holds up better than hash matching for Spark RAT. Fortinet argues its behavioral rules keep working even when operators change the tool's configuration.7 Signs worth watching for include unexpected Defender exclusions, new services or scheduled tasks launching signed binaries from unusual folders, and code injected into processes such as vssvc.exe and ctfmon.exe.1512

The wider point is that open-source offensive tools are now standard infrastructure for many threat actors, much as open-source libraries are for legitimate developers. Cases like the Cambodia campaign leave defenders with less to learn from the payload and more reason to focus on the delivery chain, especially the trusted, signed components it relies on.